Question

我有一个脚本，可以将电子邮件地址和密码添加到表中。我首先搜索表中是否存在电子邮件地址。如果是这样，我会给出一条错误消息。如果没有，我添加记录。

然后，使用mysqli_insert_id（），运行另一个查询以更新刚添加的记录，并使用md5加密密码。

但是每次我运行它时，都会添加记录，但是密码不会使用密码的md5版本更新。我已经回显了查询，它表明它应该使用加密来更新密码，但事实并非如此。有什么想法吗？

<?php
session_start();
error_reporting(E_ALL);

if (array_key_exists("submit", $_POST)) {
    $link = mysqli_connect("localhost", "eits_Admin", "WebSpinner1", "EITS_Sandbox");
    if (!$link) {
        die("Database connection error");
    }
    $error = '';
    if (!$_POST['email']) {
        $error .= "<br/>An email address is required";
    }
    if (!$_POST['password']) {
        $error .= "<br/>A password is required";
    }   
    if ($error != "") {
        $error = "There were errors in your form - ".$error;
    } else {
        $query = "select id from secretdiary 
                  where email = '".mysqli_real_escape_string($link, $_POST['email'])
                ."' limit 1";
        // echo $query;
        $result = mysqli_query($link, $query);
        if (mysqli_num_rows($result) > 0) {
            $error = "That email address is not available.";
        } else {
            $query = "insert into secretdiary 
                                (email,password) 
                      values ('" . mysqli_real_escape_string($link, $_POST['email']) 
                        . "', '" 
                        . mysqli_real_escape_string($link, $_POST['password']) . "')";

            if (!mysqli_query($link, $query)) {
                $error = "Could not sign you up at this time. Please try again later.";
            } else {
                $encPass = md5(md5(mysqli_insert_id($link)) . $_POST['password']);
                $query = "update secretdiary 
                            set password = '" . $encPass 
                        . "' where id = " . mysqli_insert_id($link) . " limit 1";
                echo $query;
                $result = mysqli_query($link,$query);
                echo "Sign up successful.";
            }
        }
    }
}
?>
<div id="error"><? echo $error; ?></div>
<form method="post">
  <input type="email" name="email" placeholder= "Your Email">
  <input type="password" name="password" placeholder="Password">
  <input type="checkbox" name="stayLoggedIn" value=1>
  <input type="submit" name="submit" value="Sign Up!">
</form>

Answer 1

对于相对简单的过程，您有很多代码行。就个人而言，您可以通过在每个HTML表单输入元素的末尾添加required来纠正表单错误（例如在本例中为空）（这是我要做的事情）

第二，md5不能安全地散列密码（您正在散列未加密的密码）

第三，这是一种使用Bcrypt从表单中哈希密码的方法，这比使用md5哈希更好。因此，like counting the usernames and if row > 0 die('username exists)之前需要做的任何错误检查都需要做，例如使用PDO

在检查用户登录时，只需使用password_verify()函数即可

整洁的代码可以帮助SO的人们理解您的问题所在，并且通常更易于阅读。我知道您可能只是在寻找'完成工作'的功能，但是它在调试时会为您提供帮助，在您寻求帮助时会为您提供帮助。

我将为您提供一种比您的安全性稍强的方法。

index.php

    <form method="post" id="regform" action="register.php">
    <input type="text" name="username" placeholder="Enter your email    Address"required/>
    <input type="password" name="password" placeholder="Enter your password" required/>
    <input type="submit" class="indexbttn" id="indexbttn" name="enter"value="enter"/>
</form>

connect.php

<?php
$servername = "localhost";
$dbusername = "root";
$dbpassword = "root";
$dbname = "fyp";
try{
$pdo = new PDO("mysql:host=$servername;dbname=$dbname",$dbusername,   $dbpassword);
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
}
catch(PDOException $e)
{
print "Error! Unable to connect: " . $e->getMessage() . "<br/>";
die();
}
?>

register.php

<?php
session_start();
require_once ('connect.php');
error_reporting(E_ALL);
ini_set('display_errors', 1);

 if(isset($_POST['enter'])){
  $username = !empty($_POST['username']) ? trim($_POST['username']) : null;
  $pass = !empty($_POST['password']) ? trim($_POST['password']) : null;
  $check (!filter_var($_POST['username'], FILTER_VALIDATE_EMAIL));

  $cnt = "SELECT COUNT(username) AS num FROM users WHERE username = :username";
  $stmt = $pdo->prepare($cnt);
  $stmt->bindValue(':username', $username);
  $stmt->execute();
  $row = $stmt->fetch(PDO::FETCH_ASSOC);
  if($row['num'] > 0){
      die('That username already exists!');
  }
  $passHash = password_hash($pass, PASSWORD_BCRYPT, array("cost" => 12));
  $insrt = "INSERT INTO users (username, password) VALUES (:username, :password)";
  $stmt = $pdo->prepare($insrt);
  $stmt->bindValue(':username', $username);
  $stmt->bindValue(':password', $passHash);
  $result = $stmt->execute();
  if($result){
    header( "refresh:5;url=index.php" );
echo 'You will be redirected in  5 seconds. If not, click <a       href="index.php">here</a>.';
  }
}
?>

login.php

<?php
 session_start();
require("connect.php");
  if(isset($_POST['enter'])){
$username = !empty($_POST['username']) ? trim($_POST['username']) :   null;
 $pass = !empty($_POST['password']) ? trim($_POST['password']) : null;
$rtrv = "SELECT username, password, userid FROM users WHERE username =       :username";
  $stmt = $pdo->prepare($rtrv);
  //Bind value.
  $stmt->bindValue(':username', $username);
  //Execute.
  $stmt->execute();
  //Fetch row.
   $user = $stmt->fetch(PDO::FETCH_ASSOC);
  //If $row is FALSE.
  if($user === false){
  //Could not find a user with that username!
  die('Incorrect username');
  }
  else{
      $validPassword = password_verify($pass, $user['password']);
    if($validPassword){
        $_SESSION['user_id'] = $user['username'];
        $_SESSION['logged_in'] = time();
        header( "Location: /protected.php" );
        die();
      } else{
          die('Wrong password!');
    }
   }
 }
 ?>

MYSQL会在记录输入后自动解密我的密码

1 个答案: